Named Pipe Security

Impersonation is the ability of a thread to execute in a security context different from that of the process that own the thread. A pipe server uses the ImpersonateNamedPipeClient function to assume the security token of the pipe client connected to the specified pipe instance. This function can be useful in determining whether to grant the request of a pipe client. For example, a named pipe server can provide access to a database or file system to which the pipe server has privileged access. When a pipe client makes a request from the server, the client typically has some lesser level of security access. By assuming the security token of the client, the server can attempt to access the protected database. The system then grants or denies the server's access, based on the security level of the client. When the server is finished, it uses the RevertToSelf function to restore its original security token.